hohn/codeql
1
0
Fork 0
mirror of https://github.com/github/codeql.git synced 2026-03-21 06:57:09 +01:00
Code Issues Packages Projects Releases Wiki Activity
14,781 Commits 1,712 Branches 163 Tags
b86b9ba510cb2935bd25ed10316c438234e28dbf
Commit Graph

4160 Commits

Author SHA1 Message Date
Alessio Della Libera
b86b9ba510 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-01 21:00:21 +02:00
Alessio Della Libera
28729915d7 Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-01 20:56:25 +02:00
Alessio Della Libera
1b50477fae Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-01 20:55:44 +02:00
Alessio Della Libera
44e728016b Update javascript/ql/src/experimental/Security/CWE-090/LdapInjection.qhelp 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-09-01 20:54:58 +02:00
ubuntu
104c9b5dac Move sinks into separate classes 2020-08-29 11:24:58 +02:00
Alessio Della Libera
8f98723822 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-29 11:18:41 +02:00
ubuntu
736f76b685 Simplify getQueryCall 2020-08-27 02:12:17 +02:00
ubuntu
30e7f958a8 Highlight API call 2020-08-27 01:42:16 +02:00
ubuntu
7eeec0d765 Correct typo example 2020-08-27 01:07:13 +02:00
ubuntu
cbe879ae73 Correct typo examples 2020-08-27 01:05:49 +02:00
ubuntu
68ff480892 Update .qhelp 2020-08-27 00:51:08 +02:00
ubuntu
13f443d2c3 Update getLdapjsClientDNMethodName 2020-08-27 00:48:29 +02:00
Alessio Della Libera
616113aeff Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-27 00:47:29 +02:00
ubuntu
94bd9c6d3e Rename LdapjsDN to LdapjsDNArgument and add it as Sink 2020-08-27 00:43:38 +02:00
ubuntu
7d36b3b4d2 Correct typo 2020-08-27 00:26:54 +02:00
ubuntu
2305a642eb Correct typo 2020-08-27 00:24:50 +02:00
Alessio Della Libera
23287aacee Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-27 00:17:55 +02:00
Alessio Della Libera
f12ac8ca60 Update javascript/ql/src/experimental/Security/CWE-090/Ldapjs.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-27 00:17:33 +02:00
Alessio Della Libera
57f3c73d3d Update javascript/ql/src/experimental/Security/CWE-090/LdapInjectionCustomizations.qll 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-26 02:08:31 +02:00
Alessio Della Libera
6979c394fe Update javascript/ql/src/experimental/Security/CWE-090/LdapInjection.qhelp 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-26 02:08:18 +02:00
Alessio Della Libera
355c7bc3b5 Update javascript/ql/src/experimental/Security/CWE-090/LdapInjection.qhelp 
Co-authored-by: Erik Krogh Kristensen <erik-krogh@github.com>
 2020-08-26 02:08:08 +02:00
ubuntu
3e97ec85b2 Add CodeQL to detect LDAP Injection in JS 2020-08-23 15:24:29 +02:00
Erik Krogh Kristensen
2c7bb8c51f adjust error message when files have been found while extracting 2020-08-13 11:18:27 +02:00
CodeQL CI
66541f260b Merge pull request #4012 from erik-krogh/getId 
Approved by asgerf, esbena
 2020-08-12 13:28:18 +01:00
Erik Krogh Kristensen
656ff9c441 autoformat 2020-08-11 15:40:30 +02:00
intrigus-lgtm
5a3acc231e Fix typo 2020-08-11 01:01:53 +02:00
Erik Krogh Kristensen
dc5167bbe7 autoformat 2020-08-10 11:52:45 +00:00
Erik Krogh Kristensen
85de5aa16b add deprecated modifier 
Co-authored-by: Asger F <asgerf@github.com>
 2020-08-10 10:51:21 +02:00
Erik Krogh Kristensen
410b696562 add deprecated aliases getId() forwarding to getIdentifier() 2020-08-10 09:11:38 +02:00
CodeQL CI
7c4e10df17 Merge pull request #4014 from erik-krogh/stringify 
Approved by esbena
 2020-08-10 07:50:21 +01:00
Erik Krogh Kristensen
aab2e6f803 update name of test file 2020-08-07 18:20:22 +02:00
Erik Krogh Kristensen
f1dc36244c update tests and queries that used getId() 2020-08-05 14:32:09 +00:00
Erik Krogh Kristensen
cc5ef4d5e1 rename JsonSerializeCall to JsonStringifyCall 2020-08-05 13:22:41 +02:00
Erik Krogh Kristensen
f70cb2e7b3 add test for new JSON serializers 2020-08-05 12:14:56 +02:00
Erik Krogh Kristensen
5a3f67a682 introduce model for JSON.stringify and similar libraries 2020-08-05 12:14:51 +02:00
Erik Krogh Kristensen
67c4320287 make JumpStmt non abstract 2020-08-05 10:03:46 +02:00
Erik Krogh Kristensen
016bdc1614 make ControlStmt non abstract 2020-08-05 09:59:30 +02:00
Erik Krogh Kristensen
5727e6f9f8 make CompoundAssignExpr non-abstract 2020-08-04 16:17:08 +02:00
Erik Krogh Kristensen
cf3f275aa1 make DestructuringPattern non-abstract 2020-08-04 16:02:32 +02:00
Erik Krogh Kristensen
0867c5567e rename getId() to getIdentifier() 2020-08-04 13:22:19 +02:00
CodeQL CI
8855ab8c8c Merge pull request #3835 from Raz0r/js/xss-protocol-sinks 
Approved by erik-krogh
 2020-08-03 15:40:05 +01:00
CodeQL CI
a4f8b19ae4 Merge pull request #3876 from erik-krogh/CWE078-Correctness 
Approved by esbena
 2020-08-03 15:38:51 +01:00
CodeQL CI
c8e5db189a Merge pull request #3913 from erik-krogh/topmost 
Approved by asgerf
 2020-08-03 13:18:22 +01:00
Erik Krogh Kristensen
f5cc14f980 fix typo 2020-08-03 13:49:21 +02:00
CodeQL CI
0bbdc70cdb Merge pull request #3864 from erik-krogh/exprString 
Approved by asgerf, esbena
 2020-08-03 09:25:17 +01:00
Arthur Baars
7e72ef350e Merge pull request #3975 from aibaars/lgtm-suites 
CodeQL: complete LGTM suites
 2020-07-30 18:39:01 +02:00
Arthur Baars
5bad003c0c Add qlpack.yml files for example queries 2020-07-29 16:57:04 +02:00
Arthur Baars
c4041e55ba CodeQL: complete LGTM suites 2020-07-28 20:40:44 +02:00
Max Schaefer
91762ec274 JavaScript: Add partial model for opener. 
3.5M weekly downloads.

Note that we do not treat the first argument as a command-injection sink. While it is possible to inject commands that way, it is more likely to cause false positives where the user input is concatenated with some prefix that makes the opening heuristic decide to treat it as a URL.
 2020-07-27 11:42:32 +01:00
Max Schaefer
9aa26fa4bc JavaScript: Add model for foreground-child. 
>1M weekly downloads, so seems worth doing.
 2020-07-27 11:37:06 +01:00